0

I have a Cisco ASA that authenticates off of RADIUS / AD. I need to give a user VPN access but I want to limit their access to only one host. What is the best way to do this?

2
  • Which version of the ASA software are you using? ASA 8.4 includes user based access-control which might work for you.
    – dunxd
    Nov 17, 2011 at 14:46
  • 8.2 and I want to upgrade but wont be able to just for this.
    – evolvd
    Nov 17, 2011 at 15:37

1 Answer 1

1

Here is what I ended up doing:

Create a new group-policy that has the split-tunnel with only the host/network I want the VPN user to access. Then create a ACL to only allow network access to what you want. Apply this ACL to the GP with the following command: vpn-filter value (you have to apply this when you are in the GP attributes). Then make a new group-tunnel and tie it back to the new GP. Now you can give this user the new PCF and the user will be locked down to the host / network you specified.

I was hoping to find a solution where I wouldn't have had to make a new GP, TP, and local ASA user but this works I guess.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .